Method and Apparatus for Hardware-Accelerated Encryption/Decryption

• US 20090060197A1
• Filed: 08/29/2008
• Published: 03/05/2009
• Est. Priority Date: 08/31/2007
• Status: Active Grant

• Current Assignee: Ip Reservoir, LLC
• Original Assignee: Exegy Incorporated
• Inventors: Thurmon, Brandon Parks, Taylor, David E., Indeck, Ronald S.
• Granted Patent: US 8,879,727 B2
• Time in Patent Office: Days
• US Class Current: 380/277
• CPC Class Codes: H04L 2209/122 Hardware reduction or efficient architectures
• CPC Class Codes: H04L 2209/125 Parallelization or pipelining, e.g. for accelerating processing of cryptographic operations
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 9/0618 Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation
• CPC Class Codes: H04L 9/0819 Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) network architectures or network communication protocols for key distribution in a packet data network H04L63/062
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0844 with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords

Abstract

An integrated circuit for data encryption/decryption and secure key management is disclosed. The integrated circuit may be used in conjunction with other integrated circuits, processors, and software to construct a wide variety of secure data processing, storage, and communication systems. A preferred embodiment of the integrated circuit includes a symmetric block cipher that may be scaled to strike a favorable balance among processing throughput and power consumption. The modular architecture also supports multiple encryption modes and key management functions such as one-way cryptographic hash and random number generator functions that leverage the scalable symmetric block cipher. The integrated circuit may also include a key management processor that can be programmed to support a wide variety of asymmetric key cryptography functions for secure key exchange with remote key storage devices and enterprise key management servers. Internal data and key buffers enable the device to re-key encrypted data without exposing data. The key management functions allow the device to function as a cryptographic domain bridge in a federated security architecture.

Claims

1. A device comprising:

an integrated circuit comprising a key-based block cipher circuit, the integrated circuit configured to (1) perform encryption/decryption using the block cipher circuit, and (2) perform a plurality of different types of key management functions.

2. The device of claim 1 wherein the block cipher circuit comprises a hardware logic circuit.

3. The device of claim 1 wherein the block cipher circuit comprises a plurality of pipelined rounds, and wherein the block cipher circuit is scalable with respect to how many of the rounds are active and how many passes through the rounds are needed to encrypt a data block.

4. The device of claim 3 wherein the scalable block cipher circuit is run-time scalable with respect to how many of the rounds are active and how many passes through the rounds are needed to encrypt a data block.

5. The device of claim 1 wherein the integrated circuit includes an encryption mode wrapper circuit in communication with the block cipher circuit, the encryption mode wrapper circuit being configured to perform a selectable mode for encryption.

6. The device of claim 1 wherein the integrated circuit is further configured to perform the plurality of different types of key management functions with at least one hardware logic circuit.

7. The device of claim 6 wherein the at least one hardware logic circuit is configured to provide key rotation as one of the key management functions.

8. The device of claim 7 wherein the integrated circuit further comprises a memory buffer to which only the integrated circuit has access, and wherein the integrated circuit is further configured to provide the key rotation by (1) decrypting an encrypted data unit with the block cipher circuit using a first key to thereby generate plaintext, (2) storing the plaintext in the memory buffer, (3) reading the plaintext out of the memory buffer, and (4) encrypting the read plaintext with the block cipher circuit using a second key to thereby generate a newly encrypted data unit.

9. The device of claim 8 wherein the integrated circuit is further configured to change an encryption mode for the newly encrypted data unit as part of the key rotation.

10. The device of claim 8 wherein the memory buffer comprises a volatile memory buffer.

11. The device of claim 6 wherein the at least one hardware logic circuit is configured to provide key generation as one of the key management functions.

12. The device of claim 11 wherein the integrated circuit comprises a randomizer circuit configured for generating keys.

13. The device of claim 11 wherein the integrated circuit comprises a cryptographic hash circuit for generating keys.

14. The device of claim 11 wherein the integrated circuit comprises a memory buffer for storing a plurality of keys in a key table, and wherein the integrated circuit is further configured to store a generated key in the key table at a specified destination index.

15. The device of claim 6 wherein the at least one hardware logic circuit is configured to provide key selection as one of the key management functions.

16. The device of claim 6 wherein the at least one hardware logic circuit is configured to provide key authentication as one of the key management functions.

17. The device of claim 16 wherein the integrated circuit comprises a cryptographic hash circuit for authenticating keys.

18. The device of claim 6 wherein the at least one hardware logic circuit is configured to provide key distribution as one of the key management functions.

19. The device of claim 18 wherein the integrated circuit comprises:

a memory buffer for storing a plurality of keys in a key table; and

wherein the integrated circuit is configured to transfer keys out of the key table.

20. The device of claim 19 wherein the integrated circuit is further configured to transfer keys out of the key table by (1) reading a key encryption key (KEK) from a register, (2) reading a key from the key table, (3) encrypting the read key with the block cipher circuit using the read KEK, and (4) distributing the encrypted key to a destination outside the integrated circuit.

21. The device of claim 6 wherein the at least one hardware logic circuit is configured to provide key storage as one of the key management functions.

22. The device of claim 21 wherein the integrated circuit comprises a memory buffer for storing a plurality of keys in a key table, and wherein the key table is configured to associate key meta-data with a plurality of the stored keys, the key meta-data comprising at least two selected from the group consisting of a key size, a key timestamp, an encryption mode, a data unit size, and an additional mode key.

23. The device of claim 6 wherein the at least one hardware logic circuit is configured to provide key loading as one of the key management functions.

24. The device of claim 23 wherein the integrated circuit comprises:

an interface to an external non-volatile memory in which a plurality of keys are stored; and

a memory buffer for storing a plurality of keys in a key table; and

wherein the integrated circuit is configured to load keys into the key table from the external non-volatile memory through the interface.

25. The device of claim 24 wherein the integrated circuit is further configured to perform the key loading by (1) reading an encrypted key from the external non-volatile memory using the interface, (2) decrypting the encrypted key with the block cipher circuit using a key encryption key (KEK), and (3) loading the decrypted key into the key table.

26. The device of claim 25 wherein the integrated circuit is further configured to (1) derive the KEK from a pass-phrase, and (2) verify the derived KEK.

27. The device of claim 23 wherein the integrated circuit is further configured to provide for loading symmetric keys via public key cryptography.

28. The device of claim 1 wherein the integrated circuit further comprises volatile memory for storing keys.

29. The device of claim 1 wherein the integrated circuit further comprises volatile memory for storing intermediate plaintext.

30. A method comprising:

performing key-based encryption/decryption within an integrated circuit using a block cipher circuit; and

performing a plurality of different types of key management functions within the integrated circuit.

31. The method of claim 30 wherein the block cipher circuit comprises a hardware logic circuit.

32. The method of claim 30 wherein the block cipher circuit comprises a plurality of pipelined rounds, the method further comprising:

scaling the block cipher circuit with respect to how many of the rounds are active and how many passes through the rounds are needed to encrypt a data block.

33. The method of claim 32 further comprising performing the scaling step at run-time.

34. The method of claim 30 further comprising selecting a mode for encryption via an encryption mode wrapper circuit within the integrated circuit.

35. The method of claim 30 wherein the step of performing a plurality of different types of key management functions comprises performing the plurality of different types of key management functions with at least one hardware logic circuit within the integrated circuit.

36. The method of claim 35 wherein the step of performing a plurality of different types of key management functions comprises providing key rotation as one of the key management functions.

37. The method of claim 35 wherein the step of performing a plurality of different types of key management functions comprises providing key generation as one of the key management functions.

38. The method of claim 35 wherein the step of performing a plurality of different types of key management functions comprises providing key selection as one of the key management functions.

39. The method of claim 35 wherein the step of performing a plurality of different types of key management functions comprises providing key authentication as one of the key management functions.

40. The method of claim 35 wherein the step of performing a plurality of different types of key management functions comprises providing key distribution as one of the key management functions.

41. The method of claim 35 wherein the step of performing a plurality of different types of key management functions comprises providing key storage as one of the key management functions.

42. The method of claim 35 wherein the step of performing a plurality of different types of key management functions comprises providing key loading as one of the key management functions.

43. The method of claim 30 further comprising storing intermediate plaintext in volatile memory within the integrated circuit.

44. A computer-readable medium comprising:

a data structure comprising logic for (1) performing key-based encryption/decryption using a block cipher circuit, and (2) performing a plurality of different types of key management functions, wherein the data structure is configured for loading on an integrated circuit to define a hardware logic circuit that realizes the block cipher circuit and a capability to perform the plurality of different types of key management functions, and wherein the data structure is resident on the computer-readable medium.

45. A system comprising:

a system interface circuit configured as a protocol bridge for receiving and outputting data;

a direct memory access (DMA) engine circuit in communication with the system interface circuit, the DMA engine circuit configured to transfer data to and from an integrated circuit via DMA;

a data routing and control circuit in communication with the DMA engine circuit, the data routing and control circuit configured to process a plurality of control commands and control a plurality of encryption and decryption operations based at least in part on the processed control commands;

a block cipher circuit in communication with the data routing and control circuit, the block cipher circuit being configured to perform a key-based encryption operation or a key-based decryption operation on data as specified by the data routing and control circuit;

a data buffer in communication with the data routing and control circuit;

a key table in communication with the data routing and control circuit, the key table being configured to store a plurality of keys;

a key management processor in communication with the data routing and control processor; and

a key management function circuit in communication with the data routing and control processor;

wherein the interface circuit, the DMA engine circuit, the data routing and control circuit, the block cipher circuit, the data buffer, the key table, the key management processor, and the key management function circuit are all resident on the integrated circuit;

wherein the key management processor is configured to provide a plurality of different types of key management functions in conjunction with the key management function circuit;

wherein the data routing and control circuit is further configured to control a routing of data and keys to and from the block cipher circuit, the key table, and the data buffer as needed to perform encryption, decryption, and key management; and

wherein the data routing and control circuit is further configured to store any intermediate plaintext generated during an encryption or decryption operation in the data buffer.

46. The system of claim 45 further comprising an encryption mode wrapper circuit in communication with the block cipher circuit and the data routing and control circuit, wherein the encryption mode wrapper circuit is configured to perform an encryption mode operation on data in response to a command from the data routing and control circuit.

47. The system of claim 45 wherein the block cipher circuit comprises a symmetric key block cipher circuit, the symmetric key block cipher circuit comprising a processing pipeline, the processing pipeline comprising a plurality of round circuits, and wherein the symmetric key block cipher circuit is run-time scalable with respect to (1) how many of the round circuits are active when encrypting or decrypting data, and (2) how many passes through the round circuits are needed to encrypt or decrypt data.

48. The system of claim 45 wherein the integrated circuit serves as a cryptographic domain bridge for data flowing across a domain boundary between a plurality of different cryptographic domains.

49. The system of claim 45 further comprising an interface circuit to an external key storage device, the interface circuit to the external key storage device being in communication with the data routing and control circuit.

50. The system of claim 45 wherein the data buffer comprises volatile memory that is not accessible from outside the integrated circuit.

51. A device comprising:

an integrated circuit comprising a scalable block cipher circuit, the integrated circuit configured to perform encryption/decryption using the scalable block cipher circuit, the scalable block cipher circuit comprising a hardware logic circuit.

52. The device of claim 51 wherein the block cipher circuit comprises a symmetric key block cipher circuit.

53. The device of claim 52 wherein the block cipher circuit comprises a processing pipeline, the processing pipeline comprising a plurality of round circuits, and wherein the block cipher circuit is scalable with respect to how many of the round circuits are active when encrypting or decrypting data.

54. The device of claim 53 wherein the block cipher circuit is further scalable with respect to how many passes through the round circuits are needed to encrypt or decrypt data.

55. The device of claim 54 wherein the block cipher circuit is configured to be run-time scalable with respect to (1) how many of the round circuits are active when encrypting data, and (2) how many passes through the round circuits are needed to encrypt data.

56. The device of claim 55 wherein the block cipher circuit comprises:

a feedback bus connecting an output of at least a plurality of the round circuits and an entry into the pipeline; and

an output bus connecting an output of at least a plurality of the round circuits and an exit from the pipeline.

57. The device of claim 56 wherein the feedback bus comprises a first feedback bus for a data state and a second feedback bus for a round key.

58. The device of claim 57 further comprising a control circuit configured to control which data state and which round key are driven to the first and second feedback buses.

59. The device of claim 56 wherein the block cipher circuit is further configured to selectively deliver both new data for encryption and feedback data from the feedback bus to a first round circuit of the pipeline, and wherein the block cipher circuit is further configured to give priority to the feedback data over the new data when both are competing for access to the first round circuit.

60. The device of claim 55 wherein the block cipher circuit is further configured to provide fixed time slot scheduling to control a delivery of data to a first round circuit of the pipeline.

61. The device of claim 55 wherein the block cipher circuit is configured to use the same round circuits for both encryption and decryption.

62. The device of claim 61 wherein each round circuit comprises a byte substitution stage circuit, a row shifting stage circuit, a round key addition stage circuit, and a column mixing stage circuit, all arranged in a pipelined order, and wherein each round circuit is configured to vary the order of the round key addition stage circuit and the column mixing stage circuit based at least in part on whether that round circuit is to be used for encryption or decryption.

63. The device of claim 62 wherein each round circuit is further configured to disable the column mixing circuit when that round circuit serves as a final round for an encryption or decryption operation.

64. The device of claim 63 wherein the byte substitution stage circuit and the row shifting stage circuit are combined into a single stage circuit.

65. The device of claim 63 wherein each round circuit further comprises:

a first multiplexer upstream from the round key addition stage circuit;

a second multiplexer upstream from the column mixing stage circuit; and

a third multiplexer downstream from the round key addition stage circuit and the column mixing stage circuit;

wherein the first multiplexer is configured to selectively deliver (i) upstream data from that round circuit and (ii) feedback data from an output of the column mixing stage circuit to the input for the round key addition stage circuit;

wherein the second multiplexer is configured to selectively deliver (i) upstream data from that round circuit and (ii) feedback data from an output of the round key addition stage circuit to the input for the column mixing stage circuit; and

wherein the third multiplexer is configured to selectively deliver (i) data from the output of the column mixing stage circuit and (ii) data from the output of the round key addition stage circuit to an output for that round circuit.

66. The device of claim 62 wherein at least a plurality of the round circuits are further configured to perform key expansion upstream from the round key addition stage circuit.

67. The device of claim 62 wherein the block cipher circuit further comprises a round key addition circuit upstream from a first round circuit in the pipeline.

68. A method comprising:

performing encryption/decryption by processing data with a scalable block cipher circuit that is implemented as a hardware logic circuit.

69. The method of claim 68 wherein the block cipher circuit comprises a symmetric key block cipher circuit.

70. The method of claim 69 wherein the block cipher circuit comprises a processing pipeline, the processing pipeline comprising a plurality of round circuits, the method further comprising scaling the block cipher circuit with respect to how many of the round circuits are active when encrypting or decrypting data.

71. The method of claim 70 further comprising scaling the block cipher circuit with respect to how many passes through the round circuits are needed to encrypt or decrypt data.

72. The method of claim 71 wherein the scaling steps comprise performing the scaling steps at run-time.

73. The method of claim 72 further comprising:

feeding back an output of at least a plurality of the round circuits to an entry into the pipeline; and

selectively outputting a plurality of outputs from the round circuits to an exit from the pipeline via an output bus.

74. The method of claim 73 further comprising selectively delivering both new data for encryption and feedback data from the feeding back step to a first round circuit of the pipeline, and wherein the selectively delivering step gives priority to the feedback data over the new data when both are competing for access to the first round circuit.

75. The method of claim 72 further comprising using the same round circuits for both encryption and decryption.

76. The method of claim 75 further comprising;

performing, in a pipelined manner within each round circuit, (i) a byte substitution operation, (ii) a row shifting operation, (iii) a round key addition operation, and (iv) a column mixing operation; and

varying an order in which the round key addition and column mixing operations are performed based at least in part on whether that round circuit is to be used for encryption or decryption.

77. The method of claim 76 further comprising:

disabling the column mixing operation for a round circuit when that round circuit serves as a final round for an encryption or decryption operation.

78. The method of claim 76 further comprising:

performing key expansion with a round circuit before the round key addition operation.

79. The method of claim 76 further comprising:

performing a round key addition operation upstream from a first round circuit in the pipeline.

80. A computer-readable medium comprising:

a data structure comprising logic for performing encryption/decryption using a scalable block cipher circuit, wherein the data structure is configured for loading on an integrated circuit to define a hardware logic circuit that realizes the scalable block cipher circuit, and wherein the data structure is resident on the computer-readable medium.

81. A device comprising:

an integrated circuit comprising a block cipher circuit, the integrated circuit configured to perform encryption and decryption using the block cipher circuit, the block cipher circuit comprising a processing pipeline, the processing pipeline comprising a plurality of round circuits, and wherein the block cipher circuit is configured to use the same round circuits for both encryption and decryption.

82. The device of claim 81 wherein the block cipher circuit comprises a symmetric key block cipher circuit.

83. The device of claim 82 wherein the block cipher circuit comprises a hardware logic circuit.

84. The device of claim 83 wherein each round circuit comprises a byte substitution stage circuit, a row shifting stage circuit, a round key addition stage circuit, and a column mixing stage circuit, all arranged in a pipelined order, and wherein each round circuit is configured to vary the order of the round key addition stage circuit and the column mixing stage circuit based at least in part on whether that round circuit is to be used for encryption or decryption.

85. The device of claim 84 wherein each round circuit is further configured to disable the column mixing circuit when that round circuit serves as a final round for an encryption or decryption operation.

86. The device of claim 85 wherein the byte substitution stage circuit and the row shifting stage circuit are combined into a single stage circuit.

87. The device of claim 85 wherein each round circuit further comprises:

a first multiplexer upstream from the round key addition stage circuit;

a second multiplexer upstream from the column mixing stage circuit; and

a third multiplexer downstream from the round key addition stage circuit and the column mixing stage circuit;

wherein the first multiplexer is configured to selectively deliver (i) upstream data from that round circuit and (ii) feedback data from an output of the column mixing stage circuit to the input for the round key addition stage circuit;

wherein the second multiplexer is configured to selectively deliver (i) upstream data from that round circuit and (ii) feedback data from an output of the round key addition stage circuit to the input for the column mixing stage circuit; and

wherein the third multiplexer is configured to selectively deliver (i) data from the output of the column mixing stage circuit and (ii) data from the output of the round key addition stage circuit to an output for that round circuit.

88. The device of claim 84 wherein at least a plurality of the round circuits are further configured to perform key expansion upstream from the round key addition stage circuit.

89. The device of claim 84 wherein the block cipher circuit further comprises a round key addition circuit upstream from a first round circuit in the pipeline.

90. A method comprising:

performing encryption and decryption using a block cipher circuit, the block cipher circuit comprising a processing pipeline, the processing pipeline comprising a plurality of round circuits, and wherein the performing step comprises using the same round circuits for both encryption and decryption.

91. The method of claim 90 wherein the block cipher circuit comprises a symmetric key block cipher circuit.

92. The method of claim 91 wherein the block cipher circuit comprises a hardware logic circuit.

93. The method of claim 92 further comprising;

performing, in a pipelined manner within each round circuit, (i) a byte substitution operation, (ii) a row shifting operation, (iii) a round key addition operation, and (iv) a column mixing operation; and

varying an order in which the round key addition and column mixing operations are performed based at least in part on whether that round circuit is to be used for encryption or decryption.

94. The method of claim 93 further comprising:

disabling the column mixing operation for a round circuit when that round circuit serves as a final round for an encryption or decryption operation.

95. The method of claim 93 further comprising:

performing key expansion with a round circuit before the round key addition operation.

96. The method of claim 93 further comprising:

performing a round key addition operation upstream from a first round circuit in the pipeline.

97. A computer-readable medium comprising:

a data structure comprising logic for a block cipher circuit, the block cipher circuit comprising a processing pipeline, the processing pipeline comprising a plurality of round circuits, wherein the block cipher circuit is configured to use the same round circuits for both encryption and decryption, wherein the data structure is configured for loading on an integrated circuit to define a hardware logic circuit that realizes the block cipher circuit, and wherein the data structure is resident on the computer-readable medium.

98. A device comprising:

a block cipher circuit; and

an encryption mode wrapper circuit in communication with the block cipher circuit;

wherein the encryption mode wrapper circuit is configured to provide an encryption mode for an encryption operation to be performed at least in part using the block cipher circuit;

wherein the encryption mode wrapper circuit is further configured to define the encryption mode in response to a control signal; and

wherein the block cipher circuit and the encryption mode circuit are implemented as hardware logic circuits within an integrated circuit.

99. The device of claim 98 wherein the encryption mode circuit is further configured to (1) provide any of a plurality of different available encryption modes for the encryption operation, and (2) select one of the encryption modes for the encryption operation in response to the control signal.

100. The device of claim 99 wherein the plurality of different available encryption modes comprises at least two selected from the group consisting of a tweakable storage cipher encryption mode, a CBC encryption mode, a CTR encryption mode, and an ECB encryption mode.

101. The device of claim 99 wherein the encryption mode wrapper circuit is configured with a plurality of different mode circuits in parallel, and wherein each of the different mode circuits are configured to operate on all data received by the encryption mode circuit, and wherein the encryption mode circuit is configured to pass an output from a selected one of the different mode circuits in response to the control signal.

102. The device of claim 99 wherein the encryption mode wrapper circuit is configured with a plurality of different mode circuits in parallel, and wherein the control signal includes an enable signal that defines which of the parallel mode circuits will be active for a given encryption operation.

103. The device of claim 98 wherein the encryption mode wrapper circuit comprises a XTS mode circuit, the XTS mode circuit being configured to utilize the block cipher circuit to provide an XTS encryption mode, and the XTS mode circuit comprising a scheduler circuit configured to schedule access to the block cipher circuit for the XTS mode circuit.

104. The device of claim 98 wherein block cipher circuit comprises a first block cipher circuit, the encryption mode wrapper circuit comprises a XTS mode circuit, the XTS mode circuit comprising a second block cipher circuit, the XTS mode circuit being configured to utilize the second block cipher circuit to provide an XTS encryption mode.

105. The device of claim 98 wherein the encryption mode wrapper circuit comprises a XTS mode circuit, the XTS mode circuit being configured to precompute a tweak value for the XTS encryption mode.